---
title: "POST /api/v1/{context_id}/keys/{key_name}/rotate"
method: POST
path: "/api/v1/{context_id}/keys/{key_name}/rotate"
---

# POST /api/v1/{context_id}/keys/{key_name}/rotate

`POST /api/v1/{context_id}/keys/{key_name}/rotate`

## Request

- The document declares no server URL.
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/surrealdb/apis/spectron/docs/api/v1/:context_id/keys/:key_name/rotate/post.ts> (a function with typed inputs; its response is checked against the schema)

Rotate the secret on the caller's own key (or, for a context administrator holding `grant:manage` over `/`, any key). The id stays stable (preserving the principal binding and attenuating grants); the previous secret stops validating immediately. A key the caller may not manage surfaces as 404. `ttlSeconds` is reset-or-inherit, matching the management rotate path.

## Path parameters

- `context_id` string, required
- `key_name` string, required

## Query parameters

- `ttlSeconds` integer, nullable

## Response `200`

Plaintext rotated key returned once

- MintedKeyJson: `POST /{ctx}/keys` response. The plaintext key is returned **once** and never persisted in this shape — the caller must store it themselves.
  - `id` string, required: The key's stable record-id key (survives rotation).
  - `key` string, required: The full bearer key (`sp-{id}-{secret}`). Send as `Authorization: Bearer …`.
  - `validUntil` string, date-time, nullable: Mint-time expiry. Absent ⇒ no expiry.

## Other responses

- `401`: Unauthorized
- `403`: Self-service keys disabled or ineligible caller
- `404`: Key does not exist or is not owned by the caller
- `422`: Invalid context id
- `503`: Server too busy: the per-pod in-flight request cap was exceeded. Retry per the `Retry-After` header.

## Changes

- **2026-08-24** `9f1598713067`: 1 info
  - added the non-success response with the status `503`
- **2026-06-16** `52b41ab517b6`: 1 info
  - endpoint added
- **2026-06-08** `741d58b9ef89`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/surrealdb/apis/spectron/changes/api/v1/:context_id/keys/:key_name/rotate/post.md)

---

[API](https://skmtc.dev/surrealdb/apis/spectron.md) - [All operations](https://skmtc.dev/surrealdb/apis/spectron/llms.txt) - [OpenAPI document](https://skmtc.dev/surrealdb/apis/spectron/revisions/9f1598713067?raw)